LearnBoost/socket.io — pull request #737 by mixu (2012-02-03 22:12:51+00:00)
Title: Supplemental fix to gavinuhma/authfix, it looks like the same Access-Control-Origin logic is needed in the http and xhr-polling transports

I noticed that POST requests over JSONP were still colored red in Chrome after gavinuhma's fix (https://github.com/LearnBoost/socket.io/pull/630 ).

It seems that that pull request did not include changes to transports/http and transports/xhr-polling, but those should also be fixed to follow https://developer.mozilla.org/En/HTTP_Access_Control#Requests_with_credentials

"Important note: when responding to a credentialed request, server must specify a domain, and cannot use wild carding. The above example would fail if the header was wildcarded as: Access-Control-Allow-Origin: *. Since the Access-Control-Allow-Origin explicitly mentions http://foo.example, the credential-cognizant content is returned to the invoking web content. "